Logstash elasticsearch output plugin - Populating api_key from metadata field does not work

Hi All,

I am using the elasticsearch output plugin of logstash to post my events to elasticsearch. I am using the api_key authentication method. It is all working fine until I have the api_key parameter value hardcoded. For Ex:

api_key => "xxxxxxxxxxxx:yyyyyyyyyyyyyyyy"

where Xs resemble id and Ys the api_key generated using the create api_key security api.

But in my filter I am adding the value to be passed to api_key parameter into a metadata field [@metadata][myapikey]. The idea is use that in the output plugin as shown below

output {
elasticsearch {
hosts => ["https://localhost:9200"]
cacert => 'path-to-ca.crt'
index => "my-index-name"
api_key => "%{[@metadata][myapikey]}"
ssl => true

As per my understanding, this should have worked like it would work if we provided the index from a metadata field like index => "%{[@metadata][some-index-name]}". I have used this for index names successfully before.

Not sure why the same implementation does not work for api_key parameter. I have made sure using stdout plugin that the metadata carries the right value in it, but still see invalid api_key value message when I run this.

Please help here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.